REMARKS 

Claims 1-30 remain pending in the instant application. Claims 1 -30 presently 
.stand rejected. Claims 1, 12, 19, 20, and 27 have been amended. Reconsideration of the 
pending claims is respectfully requested. 

Claim Rejections - 35 U.S.C. § 103 
Claims 1-18, 20-25, and 27-30 stand rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Lettvin (US 5,826,012) and further in view of Ho et al, (US 
7,188,369). 

Claims 19, 26, and 30 stand rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Lettvin and Ho, as applied to claim 1 above, and further in view of 
Huntington et al., (US 6,907,524). 

Applicants respectfully traverse the Office Action's rejections. To 
establish a prima facie case of obviousness, all claim limitations must be considered. 
MPEP § 2143. As explained below, Applicants respectfully submit that the Office 
Action has not established a prima facie case of obviousness. 

Independent claim 1 of the instant patent application as presently amended 

expressly recites: 

A method comprising: 

initializing a virus scanner during a pre-boot phase of a computer system; 

scrubbing data read from an input/output (I/O) device of the computer 
system by the \ irus scanner using a virus signature database he I ore the data is 
loaded, u herein the virus signature database is stored in a place not exposed to 
the operating system and is updated during the pre-boot phase; and 

enacting a platform policy if a virus is detected in the data. 
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In rejecting claim 1, the Office Action concedes that Lettvin is not explicit in 
teaching that the virus scanner uses a virus signature database (p. 3 Office Action mailed 
10/15/07). To attempt to make up for this deficiency in Lettvin, the Office Action cites 
Ho and concludes that it would have been obvious to one of ordinary skill in the art at 
the time of the invention to combine Lettvin with Ho to arrive at the claimed invention. 
The Office Action claims on page 3 that the motivation for doing so would be "to allow 
[the] system to use a plurality of virus signatures that can be continuously updated 
and/or replaced." Applicants traverse this reasoning as being inherently circular (i.e., 
tautological): virus signature databases inherently are continuously updated and/or 
replaced, and thus if employed, would always need to be updated or replaced. The 
alleged motivation thus begs the question of what is the motivation (in the first place) to 
combine Lettvin with Ho (to obtain a virus signature database which is the proposition 
for which Ho was cited). 

The Office Action asserts (in the Response to Arguments) that it is certainly 

possible for the virus signature database to be accessed prior to loading of an operating 

system. Applicants timely traverse this assertion because Applicants cannot find in the 

asserted references where a virus signature database signature is accessed prior to 

loading of an operating system. (Nor does the record assert that one of ordinary skill in 

the art at the time of the invention would have known this.) Lettvin instead teaches away 

from using operating systems to update virus signature databases because the Lettvin 

teaches that the presence of an operating system can obscure the presence of a virus in 

the memory of a computer. Applicant has amended the claim to clarify that the virus 

signature database is stored in a place that is not exposed to the operating system (which, 
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for example, may be corrupted by a virus, and which can, in turn, corrupt the virus 
signature database). 

Neither Lettvin nor Ho disclose, either singh or hi lairh motivated combination, 
a virus signature database that is updated during the pre-boot phase. As acknowledged 
by the Office Action Lettvin fails to teach virus signature databases. Ho fails to 
overcome this deficiency, because Ho employs operating systems to update the virus 
signature databases (the operating systems only operate after the pre-boot phase). 

Further, Lettvin teaches away from using virus signature databases as taught by 
Ho, because Lettvin is directed to software that is executed at startup of the computer 
that provides anti-virus maintenance, and/or repair functions, (see, Abstract.) At the 
very least, Lettvin and Ho in motivated combination fail to teach or suggest the 
limitation that includes "scrubbing data read from an input/output (I/O) device of the 
computer system by the virus scanner using a virus signature database before the data is 
loaded." Lettvin teaches against a modification that would allow it to perform the recited 
process steps. 

"If the proposed modification or combination of the prior art would change the 
principle of operation of the prior art invention being modified, then the teachings of the 
references are not sufficient to render the claims prima facie obvious. In re Ratti, 270 
F.2d 810, 123 USPQ 349 (CCPA 1959), MPEP 2143.01. 

Combining Lettvin with Ho as the Office Action suggests would change the 

principle of operation of the system disclosed in Lettvin. Ho teaches an antivirus 

scanning module operable with an operating system (see Abstract, Figure 3), while 

Lettvin teaches a bootstrap-time operating system [executed before the operating system 
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is booted] that causes the computer to execute one or more anti-virus or other programs 
and that facilitates the development and use of programs that must be executed before 
an ultimate operating system is executed (column 4, lines 45-64). 

Lettvin explains that executing [anti-virus software] before the ultimate operating 
system [executes] provides advantages to antivirus software because the software can 
take advantage of conditions within the computer that only exist during bootstrap and 
do not exist after the computer begins executing the ultimate operating system ( column 
4, lines 64-column 5, line 2). Lettvin further explains that viruses can, for example, 
modify the [boot sector] disk interrupt vector to point to themselves, and which is 
difficult to detect (column 5, lines 2-26). 

Thus Lettvin seeks to avoid using an operating system, which can be hijacked by 
a virus on the boot sector of the disk used to boot the operating system. As described 
above, Lettvin instead teaches antivirus software that must be executed before 
executing the operating system, which avoids executing an operating system that may be 
compromised by a virus. 

Ho is directed to (column 3, lines 31-46) teaches an anti-virus scanning module 
with an operating system that provides library functions for accessing computer virus 
signatures in a database. Accessing the computer virus signatures thus require using the 
library functions provided by the operating system. The alleged motivations to combine 
the references (for example, a plurality of virus signatures that can be continuously 
updated and/or replaced, to detect newly occurring viruses, to detect newly created 
viruses asap. to detect viruses during all phases of OS usage, and downloading the virus 
signatures from an external repository ». as taught b\ the cited art. would require the use 
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an operating system (which can be compromised by a boot sector virus) to make the 
virus signatures available to the antivirus software. Thus, to combine Lettvin with Ho 
would significantly change the principle of operation of Lettvin by requiring the use of 
an operating system which Lctivin seeks to avoid. 

Applicants further note that the "mere statement that the claimed invention is 
within the capabilities of one of ordinary skill in the art is not sufficient by itself to 
establish prima facie obviousness." MPEP § 2143.01 . Furthermore, the mere "fact that 
references can be combined or modified may be not sufficient to establish prima facie 
obviousness." Id. The tendency to resort to "hindsight" based upon Applicant's 
disclosure is often difficult to avoid due to the very nature of the examination process. 
However, impermissible hindsight must be avoided and the legal conclusion must be 
reached on the basis of the facts gleaned from the prior art." MPEP § 2142. 

Consequently, the combination of Lettvin and Ho fail to teach or suggest all 
elements of claim 1, as required under M.P.E.P. § 2143.03. Independent claims 12, 20, 
and 27 include similar nonobvious elements as discussed above in connection with 
independent claim 1 . Accordingly, Applicants request that the instant § 1 03(a) rejections 
of claims 1, 12, 20 and 27 be withdrawn. 

With further regard to claim 27, the office action asserts that Ho teaches a virtual 
machine monitor (VMM) to support at least one virtual machine (VM). According to 
the instant specification: 

A VM behaves like a complete physical machine that can run its own OS. 
Usually, each VM session is given the illusion by the VMM that it is the only 
physical machine. The VMM takes control whenever a VM attempts to perform 
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an operation that may affect the whole computer system 100. Each VM supports 
a corresponding OS and firmware. Multiple VM sessions arc separate entities 
and usually isolated from each other by the VMM. If one OS crashes or 
otherwise becomes unstable, the other OS's should not be adversely affected. 

In contrast, Ho instead teaches a virtual scanning processor that is provided at the 
application program (AP) 302 (column 5, lines 31-33). Other virtual machines can also 
be provided at the AP level 302 (column 5, lines 36-37). Thus, Ho does not teach a 
VMM as the operating system because the virtual scanning processor and virtual 
machines execute using a single operating system 300 and does not use a separate 
operating system for each virtual monitor. Claim 27, as amended, recites that each VM 
has a separate operating system. Accordingly, Applicants request that the instant 
§ 103(a) rejections of claim 27 be withdrawn. 

The dependent claims are novel and nonobvious over the cited references for at 
least the same reasons as discussed above in connection with their respective 
independent claims, in addition to adding further limitations of their own. Accordingly, 
Applicants respectfully request that the instant § 103 rejections of the dependent claims 
also be withdrawn. 

CONCLUSION 

In view of the foregoing remarks, Applicants believe the applicable rejections 
have been overcome and ali claims remaining in the application are presently in 
condition for allowance. Accordingly, favorable consideration and a Notice of 
Allowance are earnestly solicited. The Examiner is invited to telephone the undersigned 
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representative at (206) 292-8600 if the Examiner believes that an interview might be 
useful for any reason. 
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CHARGE DEPOSIT ACCOUNT 

It is not believed that extensions of time are required beyond those that may 

otherwise be provided for in documents accompanying this paper. However, if 
additional extensions of time are necessary to prevent abandonment of this application, 
then such extensions of time are hereby petitioned under 37 C.F.R. § 1.136(a). Any fees 
required therefore are hereby authorized to be charged to Deposit Account No. 02-2666. 
Please credit any overpayment to the same deposit account. 

Respectfully submitted, 

BLAKELY SOKOLOFF TAYLOR & ZAFMAN LLP 

Date: June 30. 2008 /Mark Hennings/ 

Mark R. Hennings 
Reg. No. 48,982 
Phone: (206) 292-8600 

1279 Oakmead Parkway 
Sunnyvale, California 
94085-4040 
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I hereby certt f\ Ih.it tins correspondence is being submitted 
electronically, via EFS-Web, to The United States Patent 
and Trademark Office on the date show n below. 



/Elizabeth J. Martinez/ June 3< UT< is. 

Elizabeth J. Martinez Dale 
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